fix(auth): harden project-owned secret lifetimes

[blakinio]

Purpose

Remediate validated post-W7 finding OTC2-AUD-001 with actual project-owned secret-lifetime improvements and truthful cleanup claims.

Implemented

• zero raw PKCE entropy and bounded callback scratch/request buffers on terminal drop;
• retain the callback target in a non-Clone, redacted enclosing owner that overwrites its owned allocation on drop;
• parse callback path/query directly without constructing another sensitive URL;
• move decoded callback values and the verifier into existing zeroing owners without an additional verifier string copy;
• build OAuth form, Gateway JSON and the project-owned bearer-prefix precursor inside zeroing owners;
• deserialize token, ticket and session credential fields immediately into zeroing ownership;
• overwrite rejected secret inputs and oversized sensitive response bytes before release;
• narrow architecture/evidence/catalogue/changelog language to deterministic best-effort overwrite of visible project-owned bytes only.

Explicit residual boundary

URL-library storage, allocator/compiler copies, HTTP adapter/header/body copies, TLS buffers, process arguments, operating-system state and browser state remain outside the project-owned overwrite guarantee. This PR makes no universal memory-erasure claim.

Shared-path lease

PR #23 transferred only the two W7 catalogue rows in docs/agents/MODULE_CATALOG.md and one bounded R1 entry in docs/agents/CHANGELOG.md through a durable coordination comment. No other PR #23 path or contract is changed here.

Boundaries

No password fallback, persistence, retry, async runtime, shutdown lifecycle, asset-open, architecture-policy, manifest, lockfile, dependency, workflow or external-repository change.

Validation

Restacked final head 821bd5871e708e7d03b3d375bbad537ff40ef11a is exactly one commit ahead of current base fdc2e42166a07b1a391b55ca632d5172db6d763d and passed Rust Client run 30690135419 (Windows workspace, strict Clippy, all tests, architecture policy and Supply Chain) plus repository CI run 30690135509 including CI / Required. The changed-file/diff and review-thread gates are clean.

Task

OTC2-20260801-secret-lifecycle-remediation